Created attachment 370463 [details]
PoC to trigger Denial of Service

Hi,

we found a denial of service parsing a specially crafted xml file in libxml2 if liblzma-dev package is enabled. And we have attached a poc file that never finish the parsing process. 

The reproduction is :

```
mkdir obj-native
cd obj-native/
git clone git://git.gnome.org/libxml2
env CFLAGS="-O2 -g -fstack-protector-all" ../configure --enable-static=yes --enable-shared=no
make
gdb ./xmllint
(gdb) r poc -o /tmp/null
Starting program: /tmp/libxml2/obj-native/xmllint poc -o /tmp/null
Program received signal SIGINT, Interrupt.
lzma_code (strm=strm@entry=0x761b08, action=action@entry=LZMA_FINISH) at ../../../../src/liblzma/common/common.c:247
247	../../../../src/liblzma/common/common.c: No such file or directory.
(gdb) info stack

+ Trace 238527

Some simple analysis for the loop: 

577             ret = lzma_code(strm, action);
578	        if (ret == LZMA_MEM_ERROR) {
579	            xz_error(state, LZMA_MEM_ERROR, "out of memory");
580	            return -1;
581	        }
582	        if (ret == LZMA_DATA_ERROR) {
583	            xz_error(state, LZMA_DATA_ERROR, "compressed data error");
584	            return -1;
585	        }
(gdb) 
586	        if (ret == LZMA_PROG_ERROR) {
587	            xz_error(state, LZMA_PROG_ERROR, "compression error");
588	            return -1;
589	        }
590	    } while (strm->avail_out && ret != LZMA_STREAM_END);

The ret variable in L577 is alway set to LZMA_MEMLIMIT_ERROR and strm->avail_out is not changed. So loop condition always hold true and this loop continues.

It is not the same error with Bug 757466 or CVE-2015-8035, but similiar to it.

And the patch could be like,

+        if (ret == LZMA_MEMLIMIT_ERROR) {
+            xz_error(state, LZMA_MEMLIMIT_ERROR, "memory limit error");
+            return -1;
+        }